{"ok":true,"data":{"evidence_id":"ev_188ec411ada4a30deff3aab9a30d76075ae6b00ca843793ef5ffe3530952faf2","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x18336d9c0;pdgo @ 0x18336d9c0;afij @ 0x18336d9c0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x18336d9c0;pdgo @ 0x18336d9c0;afij @ 0x18336d9c0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x18336d9c0    |void fcn.18336d9c0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int64_t iVar2;\r\n                   |    undefined8 uVar3;\r\n                   |    code *pcVar4;\r\n                   |    int64_t iVar5;\r\n                   |    undefined auStack_b8 [32];\r\n                   |    int64_t var_98h;\r\n                   |    int64_t var_88h;\r\n                   |    undefined8 uStack_80;\r\n                   |    undefined uStack_60;\r\n                   |    int64_t var_58h;\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_48h;\r\n                   |    \r\n    0x18336d9e0    |    var_48h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_b8;\r\n    0x18336d9ed    |    if (*(char *)(arg4 + 0x28) == '\\x01') {\r\n    0x18336d9ef    |        var_50h = 0;\r\n    0x18336d9f8    |        piVar1 = *(int32_t **)arg3;\r\n    0x18336d9fe    |        if (piVar1 == (int32_t *)0x0) goto code_r0x00018336dbd4;\r\n    0x18336da04    |        *(undefined8 *)arg3 = 0;\r\n    0x18336da1a    |        (*(code *)0x185f59da0)(piVar1, arg4, &var_50h);\r\n    0x18336da20    |        LOCK();\r\n    0x18336da20    |        *piVar1 = *piVar1 + -1;\r\n    0x18336da20    |        UNLOCK();\r\n    0x18336da24    |        if (*piVar1 == 0) {\r\n    0x18336da2d    |            (*(code *)0x185f59da0)(piVar1);\r\n                   |        }\r\n    0x18336da33    |        iVar2 = var_50h;\r\n    0x18336da38    |        var_50h = 0;\r\n    0x18336da44    |        if (iVar2 != 0) {\r\n    0x18336dbe2    |            func_0x00018124f850(iVar2, 1);\r\n                   |        }\r\n    0x18336da4d    |        if (arg2 != 0) {\r\n    0x18336da53    |            LOCK();\r\n    0x18336da53    |            piVar1 = (int32_t *)(arg2 + 8);\r\n    0x18336da53    |            *piVar1 = *piVar1 + -1;\r\n    0x18336da53    |            UNLOCK();\r\n    0x18336da57    |            if (*piVar1 == 0) {\r\n    0x18336da60    |                func_0x000185578b40(arg2);\r\n                   |            }\r\n                   |        }\r\n                   |    } else {\r\n    0x18336da6a    |        iVar2 = *(int64_t *)(arg4 + 0x30);\r\n    0x18336da71    |        if (iVar2 == 0) {\r\n    0x18336dbd7    |            pcVar4 = (code *)swi(3);\r\n    0x18336dbd7    |            (*pcVar4)();\r\n    0x18336dbd7    |            return;\r\n                   |        }\r\n    0x18336da7e    |        iVar5 = func_0x000185f006b8(0x38);\r\n    0x18336da89    |        *(undefined8 *)(arg4 + 0x30) = 0;\r\n    0x18336da95    |        uStack_80 = *(undefined8 *)(arg4 + 0x38);\r\n    0x18336da9d    |        *(undefined8 *)(arg4 + 0x38) = 0;\r\n    0x18336dab4    |        var_98h = arg2;\r\n    0x18336dab4    |        var_88h = iVar2;\r\n    0x18336dab4    |        func_0x00018134a090(iVar5, arg1 & 0xffffffff, 1, &var_88h);\r\n    0x18336dabe    |        var_88h = var_88h & 0xffffffffffffff00;\r\n    0x18336dac1    |        uStack_60 = 0;\r\n    0x18336dac5    |        piVar1 = *(int32_t **)arg3;\r\n    0x18336dacb    |        var_58h = iVar5;\r\n    0x18336dacb    |        if (piVar1 == (int32_t *)0x0) {\r\n    0x18336dbda    |            pcVar4 = (code *)swi(3);\r\n    0x18336dbda    |            (*pcVar4)();\r\n    0x18336dbda    |            return;\r\n                   |        }\r\n    0x18336dad1    |        *(undefined8 *)arg3 = 0;\r\n    0x18336dae9    |        (*(code *)0x185f59da0)(piVar1, &var_88h, &var_58h);\r\n    0x18336daef    |        LOCK();\r\n    0x18336daef    |        *piVar1 = *piVar1 + -1;\r\n    0x18336daef    |        UNLOCK();\r\n    0x18336daf2    |        if (*piVar1 == 0) {\r\n    0x18336dafb    |            (*(code *)0x185f59da0)(piVar1);\r\n                   |        }\r\n    0x18336db01    |        iVar2 = var_58h;\r\n    0x18336db06    |        var_58h = 0;\r\n    0x18336db12    |        if (iVar2 != 0) {\r\n    0x18336dbf1    |            func_0x00018124f850(iVar2, 1);\r\n                   |        }\r\n                   |    }\r\n    0x18336db18    |    piVar1 = *(int32_t **)arg3;\r\n    0x18336db1e    |    if (piVar1 != (int32_t *)0x0) {\r\n    0x18336db65    |        LOCK();\r\n    0x18336db65    |        *piVar1 = *piVar1 + -1;\r\n    0x18336db65    |        UNLOCK();\r\n    0x18336db68    |        if (*piVar1 == 0) {\r\n    0x18336db6e    |            (*(code *)0x185f59da0)();\r\n                   |        }\r\n                   |    }\r\n    0x18336db20    |    iVar2 = *(int64_t *)(arg4 + 0x30);\r\n    0x18336db24    |    *(undefined8 *)(arg4 + 0x30) = 0;\r\n    0x18336db2f    |    if (iVar2 != 0) {\r\n    0x18336db76    |        uVar3 = *(undefined8 *)(arg4 + 0x38);\r\n    0x18336db88    |        func_0x000184339cd0(&var_88h, 0x190124590, 0x1901b9970, 0x19e);\r\n    0x18336dbb2    |        (*(code *)0x185f59da0)(uVar3, &var_88h, 0x18336e430, iVar2);\r\n                   |    }\r\n    0x18336db38    |    if (*(int64_t *)(arg4 + 0x38) != 0) {\r\n    0x18336db3a    |        LOCK();\r\n    0x18336db3a    |        piVar1 = (int32_t *)(*(int64_t *)(arg4 + 0x38) + 8);\r\n    0x18336db3a    |        *piVar1 = *piVar1 + -1;\r\n    0x18336db3a    |        UNLOCK();\r\n    0x18336db3e    |        if (*piVar1 == 0) {\r\n    0x18336dbbd    |            func_0x000185578b40();\r\n                   |        }\r\n                   |    }\r\n    0x18336db52    |    if (*(uint64_t *)0x191c71040 == (var_48h ^ (uint64_t)auStack_b8)) {\r\n    0x18336db64    |        return;\r\n                   |    }\r\n    0x18336dbcc    |    func_0x000185f05b40(var_48h ^ (uint64_t)auStack_b8);\r\n                   |code_r0x00018336dbd4:\r\n    0x18336dbd4    |    pcVar4 = (code *)swi(3);\r\n    0x18336dbd4    |    (*pcVar4)();\r\n    0x18336dbd4    |    return;\r\n                   |}\r\n[{\"offset\":6496377280,\"name\":\"fcn.18336d9c0\",\"size\":571,\"is-pure\":false,\"realsz\":565,\"noreturn\":false,\"stackframe\":184,\"calltype\":\"ms\",\"cost\":203,\"cc\":20,\"loops\":6,\"bits\":64,\"type\":\"fcn\",\"nbbs\":29,\"edges\":41,\"ebbs\":4,\"signature\":\"fcn.18336d9c0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);\",\"minbound\":6496377280,\"maxbound\":6496377851,\"callrefs\":[{\"from\":6496377370,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496377389,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496377440,\"to\":6532074304,\"type\":\"CALL\"},{\"from\":6496377445,\"to\":6496377624,\"type\":\"CODE\"},{\"from\":6496377470,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6496377524,\"to\":6462677136,\"type\":\"CALL\"},{\"from\":6496377577,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496377595,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496377710,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496377716,\"to\":6496377632,\"type\":\"CODE\"},{\"from\":6496377750,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6496377778,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496377784,\"to\":6496377649,\"type\":\"CODE\"},{\"from\":6496377789,\"to\":6532074304,\"type\":\"CALL\"},{\"from\":6496377794,\"to\":6496377664,\"type\":\"CODE\"},{\"from\":6496377807,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6496377826,\"to\":6461651024,\"type\":\"CALL\"},{\"from\":6496377831,\"to\":6496377418,\"type\":\"CODE\"},{\"from\":6496377841,\"to\":6461651024,\"type\":\"CALL\"},{\"from\":6496377846,\"to\":6496377624,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6496377305,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6496377672,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6496377722,\"to\":6712083856,\"type\":\"DATA\"},{\"from\":6496377729,\"to\":6712695152,\"type\":\"DATA\"},{\"from\":6496377762,\"to\":6496379952,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6496377445,\"to\":6496377624,\"type\":\"CODE\"},{\"from\":6496377716,\"to\":6496377632,\"type\":\"CODE\"},{\"from\":6496377784,\"to\":6496377649,\"type\":\"CODE\"},{\"from\":6496377794,\"to\":6496377664,\"type\":\"CODE\"},{\"from\":6496377831,\"to\":6496377418,\"type\":\"CODE\"},{\"from\":6496377846,\"to\":6496377624,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":6,\"outdegree\":14,\"nlocals\":5,\"nargs\":4,\"stackvars\":[{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x18336d9c0    |void fcn.18336d9c0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int64_t iVar2;\r\n                   |    undefined8 uVar3;\r\n                   |    code *pcVar4;\r\n                   |    int64_t iVar5;\r\n                   |    undefined auStack_b8 [32];\r\n                   |    int64_t var_98h;\r\n                   |    int64_t var_88h;\r\n                   |    undefined8 uStack_80;\r\n                   |    undefined uStack_60;\r\n                   |    int64_t var_58h;\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_48h;\r\n                   |    \r\n    0x18336d9e0    |    var_48h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_b8;\r\n    0x18336d9ed    |    if (*(char *)(arg4 + 0x28) == '\\x01') {\r\n    0x18336d9ef    |        var_50h = 0;\r\n    0x18336d9f8    |        piVar1 = *(int32_t **)arg3;\r\n    0x18336d9fe    |        if (piVar1 == (int32_t *)0x0) goto code_r0x00018336dbd4;\r\n    0x18336da04    |        *(undefined8 *)arg3 = 0;\r\n    0x18336da1a    |        (*(code *)0x185f59da0)(piVar1, arg4, &var_50h);\r\n    0x18336da20    |        LOCK();\r\n    0x18336da20    |        *piVar1 = *piVar1 + -1;\r\n    0x18336da20    |        UNLOCK();\r\n    0x18336da24    |        if (*piVar1 == 0) {\r\n    0x18336da2d    |            (*(code *)0x185f59da0)(piVar1);\r\n                   |        }\r\n    0x18336da33    |        iVar2 = var_50h;\r\n    0x18336da38    |        var_50h = 0;\r\n    0x18336da44    |        if (iVar2 != 0) {\r\n    0x18336dbe2    |            func_0x00018124f850(iVar2, 1);\r\n                   |        }\r\n    0x18336da4d    |        if (arg2 != 0) {\r\n    0x18336da53    |            LOCK();\r\n    0x18336da53    |            piVar1 = (int32_t *)(arg2 + 8);\r\n    0x18336da53    |            *piVar1 = *piVar1 + -1;\r\n    0x18336da53    |            UNLOCK();\r\n    0x18336da57    |            if (*piVar1 == 0) {\r\n    0x18336da60    |                func_0x000185578b40(arg2);\r\n                   |            }\r\n                   |        }\r\n                   |    } else {\r\n    0x18336da6a    |        iVar2 = *(int64_t *)(arg4 + 0x30);\r\n    0x18336da71    |        if (iVar2 == 0) {\r\n    0x18336dbd7    |            pcVar4 = (code *)swi(3);\r\n    0x18336dbd7    |            (*pcVar4)();\r\n    0x18336dbd7    |            return;\r\n                   |        }\r\n    0x18336da7e    |        iVar5 = func_0x000185f006b8(0x38);\r\n    0x18336da89    |        *(undefined8 *)(arg4 + 0x30) = 0;\r\n    0x18336da95    |        uStack_80 = *(undefined8 *)(arg4 + 0x38);\r\n    0x18336da9d    |        *(undefined8 *)(arg4 + 0x38) = 0;\r\n    0x18336dab4    |        var_98h = arg2;\r\n    0x18336dab4    |        var_88h = iVar2;\r\n    0x18336dab4    |        func_0x00018134a090(iVar5, arg1 & 0xffffffff, 1, &var_88h);\r\n    0x18336dabe    |        var_88h = var_88h & 0xffffffffffffff00;\r\n    0x18336dac1    |        uStack_60 = 0;\r\n    0x18336dac5    |        piVar1 = *(int32_t **)arg3;\r\n    0x18336dacb    |        var_58h = iVar5;\r\n    0x18336dacb    |        if (piVar1 == (int32_t *)0x0) {\r\n    0x18336dbda    |            pcVar4 = (code *)swi(3);\r\n    0x18336dbda    |            (*pcVar4)();\r\n    0x18336dbda    |            return;\r\n                   |        }\r\n    0x18336dad1    |        *(undefined8 *)arg3 = 0;\r\n    0x18336dae9    |        (*(code *)0x185f59da0)(piVar1, &var_88h, &var_58h);\r\n    0x18336daef    |        LOCK();\r\n    0x18336daef    |        *piVar1 = *piVar1 + -1;\r\n    0x18336daef    |        UNLOCK();\r\n    0x18336daf2    |        if (*piVar1 == 0) {\r\n    0x18336dafb    |            (*(code *)0x185f59da0)(piVar1);\r\n                   |        }\r\n    0x18336db01    |        iVar2 = var_58h;\r\n    0x18336db06    |        var_58h = 0;\r\n    0x18336db12    |        if (iVar2 != 0) {\r\n    0x18336dbf1    |            func_0x00018124f850(iVar2, 1);\r\n                   |        }\r\n                   |    }\r\n    0x18336db18    |    piVar1 = *(int32_t **)arg3;\r\n    0x18336db1e    |    if (piVar1 != (int32_t *)0x0) {\r\n    0x18336db65    |        LOCK();\r\n    0x18336db65    |        *piVar1 = *piVar1 + -1;\r\n    0x18336db65    |        UNLOCK();\r\n    0x18336db68    |        if (*piVar1 == 0) {\r\n    0x18336db6e    |            (*(code *)0x185f59da0)();\r\n                   |        }\r\n                   |    }\r\n    0x18336db20    |    iVar2 = *(int64_t *)(arg4 + 0x30);\r\n    0x18336db24    |    *(undefined8 *)(arg4 + 0x30) = 0;\r\n    0x18336db2f    |    if (iVar2 != 0) {\r\n    0x18336db76    |        uVar3 = *(undefined8 *)(arg4 + 0x38);\r\n    0x18336db88    |        func_0x000184339cd0(&var_88h, 0x190124590, 0x1901b9970, 0x19e);\r\n    0x18336dbb2    |        (*(code *)0x185f59da0)(uVar3, &var_88h, 0x18336e430, iVar2);\r\n                   |    }\r\n    0x18336db38    |    if (*(int64_t *)(arg4 + 0x38) != 0) {\r\n    0x18336db3a    |        LOCK();\r\n    0x18336db3a    |        piVar1 = (int32_t *)(*(int64_t *)(arg4 + 0x38) + 8);\r\n    0x18336db3a    |        *piVar1 = *piVar1 + -1;\r\n    0x18336db3a    |        UNLOCK();\r\n    0x18336db3e    |        if (*piVar1 == 0) {\r\n    0x18336dbbd    |            func_0x000185578b40();\r\n                   |        }\r\n                   |    }\r\n    0x18336db52    |    if (*(uint64_t *)0x191c71040 == (var_48h ^ (uint64_t)auStack_b8)) {\r\n    0x18336db64    |        return;\r\n                   |    }\r\n    0x18336dbcc    |    func_0x000185f05b40(var_48h ^ (uint64_t)auStack_b8);\r\n                   |code_r0x00018336dbd4:\r\n    0x18336dbd4    |    pcVar4 = (code *)swi(3);\r\n    0x18336dbd4    |    (*pcVar4)();\r\n    0x18336dbd4    |    return;\r\n                   |}\r\n[{\"offset\":6496377280,\"name\":\"fcn.18336d9c0\",\"size\":571,\"is-pure\":false,\"realsz\":565,\"noreturn\":false,\"stackframe\":184,\"calltype\":\"ms\",\"cost\":203,\"cc\":20,\"loops\":6,\"bits\":64,\"type\":\"fcn\",\"nbbs\":29,\"edges\":41,\"ebbs\":4,\"signature\":\"fcn.18336d9c0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);\",\"minbound\":6496377280,\"maxbound\":6496377851,\"callrefs\":[{\"from\":6496377370,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496377389,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496377440,\"to\":6532074304,\"type\":\"CALL\"},{\"from\":6496377445,\"to\":6496377624,\"type\":\"CODE\"},{\"from\":6496377470,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6496377524,\"to\":6462677136,\"type\":\"CALL\"},{\"from\":6496377577,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496377595,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496377710,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496377716,\"to\":6496377632,\"type\":\"CODE\"},{\"from\":6496377750,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6496377778,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496377784,\"to\":6496377649,\"type\":\"CODE\"},{\"from\":6496377789,\"to\":6532074304,\"type\":\"CALL\"},{\"from\":6496377794,\"to\":6496377664,\"type\":\"CODE\"},{\"from\":6496377807,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6496377826,\"to\":6461651024,\"type\":\"CALL\"},{\"from\":6496377831,\"to\":6496377418,\"type\":\"CODE\"},{\"from\":6496377841,\"to\":6461651024,\"type\":\"CALL\"},{\"from\":6496377846,\"to\":6496377624,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6496377305,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6496377672,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6496377722,\"to\":6712083856,\"type\":\"DATA\"},{\"from\":6496377729,\"to\":6712695152,\"type\":\"DATA\"},{\"from\":6496377762,\"to\":6496379952,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6496377445,\"to\":6496377624,\"type\":\"CODE\"},{\"from\":6496377716,\"to\":6496377632,\"type\":\"CODE\"},{\"from\":6496377784,\"to\":6496377649,\"type\":\"CODE\"},{\"from\":6496377794,\"to\":6496377664,\"type\":\"CODE\"},{\"from\":6496377831,\"to\":6496377418,\"type\":\"CODE\"},{\"from\":6496377846,\"to\":6496377624,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":6,\"outdegree\":14,\"nlocals\":5,\"nargs\":4,\"stackvars\":[{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4967ms"}}